On 15 February 2022, the European Data Protection Board (EDPB) launched the first coordinated enforcement action under the coordinated enforcement framework (CEF) which was set up in October 2021.
The supervisory authorities will investigate the use of cloud-based services by the public sector. Through this coordinated action, the EDPB aims to foster best practices and ensure the adequate protection of personal data. The outcomes are expected to be of practical use for entities operating in private sector as well.
The enforcement action will involve 22 supervisory authorities across the EEA (including, among others, Latvia, Belgium, Spain, France, Italy, Netherlands, Portugal, several German DPAs, Iceland and the European Data Protection Supervisor). The EDPB states that more than 80 institutions will be part of the investigation throughout the EEA, including EU bodies, and across a wide range of sectors (naming specifically, health, finance, tax, education, central procurement and providers of IT services).
The investigations by the Supervisory Authorities will examine the challenges that public bodies face regarding GDPR compliance when using cloud-based services, including:
- the safeguards and processes implemented when acquiring the cloud services;
- international transfer aspects; and
- the contractual provisions governing the controller-processor relationship.
The EDPB summarises the procedural steps (ranging from the fact-finding exercises, sending out preliminary questionnaires to formal investigations and follow-up actions). The results of this enforcement action will be analysed in a coordinated manner and national supervisory authorities will decide on possible further national supervision and enforcement actions. A report on the general outcomes of this enforcement action is expected before the end of 2022.
Read the EDPB press release 'Launch of coordinated enforcement on use of cloud by public sector'.
